Are the domain admins in a different container than the regular users in AD? (usually the case) If so, you'll need to confirm that the authentication is checking not just the users container but the administrators container as well.